ATT&CK coverage › Technique

Hijack Execution Flow: DLL T1574.001

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Events covered

14 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon7Image loaded
Sysmon11FileCreate
Sysmon13RegistryEvent (Value Set)
Security-Auditing4688A new process has been created.
DHCP-Server1031[EVENT_SERVER_CALLOUT_UNHANDLED_EXCEPTION] The installed server callout .dll file has caused an exception.
DHCP-Server1032[EVENT_SERVER_CALLOUT_LOAD_EXCEPTION] The installed server callout .dll file has caused an exception. The .dll file couldn't be loaded.
DHCP-Server1033[EVENT_SERVER_CALLOUT_LOAD_SUCCESS] The DHCP service has successfully loaded one or more callout DLLs.
DHCP-Server1034[EVENT_SERVER_READ_ONLY_GROUP_ERROR] The DHCP service has failed to load one or more callout DLLs.
DNS-Server-Service150The DNS server could not load or initialize the plug-in DLL Name.
DNS-Server-Service770A DNS server plugin DLL has been loaded from location param1 on server param2.
DNS-Server-Service771The V1 plugin interface has been implemented in server level plugin DLL.
Security-Mitigations11Process 'ProcessPath' (PID ProcessId) would have been blocked from loading the non-Microsoft-signed binary 'ImageName'.
Security-Mitigations12Process 'ProcessPath' (PID ProcessId) was blocked from loading the non-Microsoft-signed binary 'ImageName'.

Authoring guide

Patterns shared across the 91 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (21 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
ImageLoaded62ends_with 49, starts_with 33, match 17, eq 9, in 5C:\Windows\WinSxS\, C:\Program Files (x86)\, C:\Program Files\, C:\Windows\SystemTemp\, C:\Program Files (x86)\Windows Kits\
Image44ends_with 32, starts_with 12, eq 10, match 8, is_null 1\pwsh.exe, \VMwareXferlogs.exe, C:\Program Files (x86)\CCleaner\, C:\Program Files\Microsoft Security Client\, C:\Program Files (x86)\Windows Defender\
Signed13eq 13true, false, "false"
EventID10eq 107
SignatureStatus9eq 7, ne 2Valid, valid, Unavailable, Expired, "unavailable"
TargetFilename7ends_with 5, starts_with 2, match 2, in 1:\Windows\System32\offdmpsvc.dll, :\Windows\System32\WLBSCTRL.dll, :\Windows\System32\axeonoffhelper.dll, C:\Windows\SoftwareDistribution\, C:\Windows\UUS\arm64\
OriginalFileName6eq 6deviceenroller.exe, jli.dll, RUNDLL32.EXE, regsvr32.exe, PowerShell.EXE
TargetObject3ends_with 3\Services\DHCPServer\Parameters\CalloutEnabled, \Services\DHCPServer\Parameters\CalloutDlls, \services\DNS\Parameters\ServerLevelPluginDll, \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLib, \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLibPath
CommandLine3match 3/config, /serverlevelplugindll, /PhoneDeepLink, copy , C:\Windows\SysWow64\Tasks\
Signature3eq 3QFX Software Corporation, Microsoft Windows, Nextron Systems GmbH
islibrary3eq 3TRUE, True
Provider_Name2eq 2Microsoft-Windows-DHCP-Server
Product2starts_with 1, eq 1OpenJDK Platform, Python
Description2eq 2OpenJDK Platform binary, Python
Company2eq 2Python Software Foundation, "Microsoft Corporation"

Top indicator values (881 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
EventIDeq71035
ImageLoadedstarts_withC:\Windows\WinSxS\99
ImageLoadedstarts_withC:\Windows\SysWOW64\78
ImageLoadedstarts_withC:\Windows\System32\78
Signedeqtrue78
ImageLoadedstarts_withC:\Program Files\66
ImageLoadedstarts_withC:\Program Files (x86)\66
Signedeqfalse58
Imageends_with\pwsh.exe3140
Imageends_with\powershell.exe3143
ImageLoadedstarts_withC:\Program Files (x86)\Windows Kits\33
SignatureStatuseqValid34
Imagestarts_withC:\Windows\WinSxS\313
ImageLoadedends_with\wininet.dll22
ImageLoadedends_with\profapi.dll22
ImageLoadedends_with\wtsapi32.dll22
ImageLoadedends_with\cryptbase.dll22
ImageLoadedends_with\iphlpapi.dll22
ImageLoadedends_with\cryptsp.dll22
ImageLoadedends_with\sspicli.dll22

Common exclusions (36 distinct)

Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.

FieldKindValueRules excluding
Imagein"*\\syswow64\\*"1
Imagein"*\\winsxs\\*"1
Imagein"*\\windows\\*"1
Imagein"*\\System32\\*"1
TargetFilenamein"*\\WinSxS\\*defender-service*"1
TargetFilenamein"*\\Program Files\\windows defender\\*"1
TargetFilenamein"*\\WinSxS\\Temp\\*defender-service*"1
process_namein"*\\winsxs\\*"1
process_namein"*\\wbem\\*"1
process_namein"*\\syswow64\\*"1
process_namein"*\\system32\\*"1
ImageLoadedin"*:\\Windows\\WinSXS\\*"1
ImageLoadedin"*:\\Windows\\System32\\*"1
ImageLoadedin"*:\\Windows\\SysWOW64\\*"1
Imagein"*:\\Windows\\System32\\*"1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 78 rules

Splunk 12 rules

Kusto Query Language 1 rule